JP2008210091A - Authentication system and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To present an authentication method to be used also as the substitute of biometrics. <P>SOLUTION: An authentication terminal receives a temporary code composed of an arbitrary character string, and generates a terminal specifying code which includes information for specifying the authentication terminal, based on the temporary code (S3). An authentication management server checks the validity of the authentication terminal according to the terminal specifying code, and generates a confirmation code which includes information indicating the temporary code in the case of validity (S7). The authentication terminal receives the inputs of the code corresponding to the confirmation code and the code corresponding to the temporary code, and inspects compatibility in the code corresponding to the confirmation code (S9-S11). When the confirmation code is determined to be appropriate, the authentication terminal generates a one-time password, and requests the generation of the same one-time password to the authentication management server (S12, S13). The authentication management server generates the one-time password in response to a request from the authentication terminal, and requests the change of the password to an authentication usage device (S15). <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an authentication system and method.

  With the spread and sophistication of network systems, biometric authentication has been widely used as a personal authentication means instead of passwords. For example, an individual is recognized with features unique to each individual such as a fingerprint, vein pattern, iris or face.

However, in consideration of a case where a reading device that reads biometric features in these biometric authentication systems breaks down, some relief means is required. Patent Document 1 describes a rescue method when biometric authentication cannot be used.
JP 2006-251961 A

  Simple remedies such as the use of registered passwords can lead to the safety of biometric authentication. A highly secure authentication means that is comparable to biometric authentication is desired.

  It is an object of the present invention to present an authentication system and method that can be used as an alternative to biometric authentication.

  The authentication system according to the present invention is an authentication system comprising an authentication terminal and an authentication management server, and accepts a temporary code consisting of an arbitrary character string in the authentication terminal and identifies the authentication terminal from the temporary code. Terminal identification code generating means for generating a terminal identification code including information, and the authentication management server confirms the validity of the authentication terminal in accordance with the terminal identification code, and if it is valid, information indicating the temporary code A verification code generating means for generating a verification code including the code, the authentication terminal accepting input of a code corresponding to the verification code and a code corresponding to the temporary code, and conformance of the code corresponding to the verification code Confirmation code inspection means for inspecting the password, and a one-time password is generated if the confirmation code inspection means determines that it is compatible And a first one-time password generation request means for requesting the authentication management server to generate the same one-time password, and the one-time password generated in the first one-time password generation request step for authentication. A password transmitting means for transmitting to the authentication using device, wherein the authentication management server generates the one-time password according to a request from the authentication terminal and requests the authentication using device to change the password. One-time password generation requesting means is provided.

  An authentication method according to the present invention includes an authentication system including an authentication terminal and an authentication management server, wherein the authentication terminal accepts a temporary code composed of an arbitrary character string and includes information for identifying the authentication terminal from the temporary code. A terminal identification code generation step for generating a terminal identification code, and the authentication management server confirms the validity of the authentication terminal according to the terminal identification code, and if it is valid, a confirmation code including information indicating the temporary code Confirmation code generation step to be generated, and at the authentication terminal, an input of a code corresponding to the confirmation code and a code corresponding to the temporary code is received, and a confirmation code inspection is performed to check the suitability of the code corresponding to the confirmation code Step and the authentication terminal, if the verification code inspection step And generating a one-time password and requesting the authentication management server to generate the same one-time password, and in the authentication management server, in accordance with a request from the authentication terminal, A second one-time password generation request step for generating a one-time password and requesting the authentication using device to change the password, and the one-time password generated in the first one-time password generation request step in the authentication terminal And a password transmission step of transmitting the password to the authentication using apparatus for authentication.

  According to the present invention, a highly secure authentication system can be provided without requiring the user to memorize a specific password. In particular, it can be used not only for single use but also as an alternative to biometric authentication.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 shows a schematic block diagram of an authentication utilization system which is an embodiment of the present invention. The authentication terminal 10 has a function of authenticating an individual with its biometric and is connected to the biometric authentication management server 14 and the authentication using device 16 via the communication network 12. The authentication using device 16 is, for example, a device that provides a predetermined service or function to a user authenticated by the authentication terminal 10.

  The authentication terminal 10 includes a reading / feature extraction device 20 that reads a feature portion of a living body and extracts a feature. The authentication terminal 10 further includes a display device 22, a keyboard (or touch panel) 24, a communication device 26, a timer 28, an authentication mode switching button 30, a storage device 32, and a CPU 34 that executes various programs. The storage device 32 stores a terminal ID (serial number), a site ID (site serial number), and a biometric authentication key X.

  The biometric authentication management server 14 includes a display device 40, a keyboard (or touch panel) 42, a communication device 44, a timer 46, a storage device 48, a CPU 50, and a random number generation device 52. The storage device 48 stores a terminal ID, a site ID, and an authentication key X for a plurality of authentication terminals at a plurality of sites managed by the server 14. The authentication key X may be set for each site or may be set for each individual authentication terminal.

  The biometric authentication management server 14 stores the biometric information of the user in the storage device 48 and the like, and has a function of specifying the user from the biometric information read by the authentication terminal 10. However, since this function is not necessary for understanding the present embodiment, detailed description thereof is omitted.

  The timer 28 of the authentication terminal 10 and the timer 46 of the biometric authentication management server 14 are synchronized with a network time server, for example, and always indicate the same time.

  FIG. 2 shows a flowchart of the basic operation of this embodiment. When biometric authentication can be used (S1), the user accesses the authentication using device 16 using biometric authentication and uses the service or function (S2). The operation after the user is confirmed by biometric authentication is the same as that after step S12.

  When biometric authentication cannot be used in the authentication terminal 10 as in the case where a device that reads a biometric device fails, the user switches to password authentication using the authentication mode switching button 30 (S1). Although details will be described later, the user inputs a temporary code T composed of a character string arbitrarily generated on the spot by the user to the authentication terminal 10. The authentication terminal 10 generates a terminal identification code A that identifies the authentication terminal 10 using the temporary code T, and displays it on the screen of the display device 22 (S3). The terminal identification code A is encrypted with the temporary code T, the time information (Y) when the temporary code T is input, the terminal ID encrypted with the authentication key X, and the site encrypted with the authentication key X It consists of an ID.

  The user reads the terminal identification code A displayed on the display device 22, and notifies the administrator of the biometric management server 14 of the terminal identification code A with a fixed phone or a mobile phone (S4). At this time, the administrator specifies the user by the user's address, name, birthday, and the like. The user can be specified by adopting a method in which the user answers a question or the like set in advance for each user. In this case, questions and answers may be exchanged between the authentication terminal 10 and the biometric authentication management server 14.

  In the case of an appropriate user having the right to use the authentication terminal 10, the administrator activates the confirmation code generation program on the biometric authentication management server 14 and inputs the terminal identification code A (S5). When confirming a user online, based on the confirmation result, the biometric authentication management server 14 inputs the terminal identification code A into the confirmation code generation program.

  The biometric authentication management server 14 decrypts the input terminal identification code A with the authentication key X, and collates whether the terminal ID and the site ID are appropriate (S6). If the terminal ID or the site ID is illegal or the combination of the terminal ID and the site ID is illegal, the collation result is NG.

  When the collation result is NG (S6), the confirmation code generation program of the biometric authentication management server 14 displays the fact on the display device 40. When NG is displayed, the administrator notifies the user of disapproval. When the authentication terminal 10 and the biometric authentication management server 14 are communicating, the disapproval is displayed on the display device 22 of the authentication terminal 10.

  If the collation result is appropriate (S6), the confirmation code generation program of the biometric authentication management server 14 generates a confirmation code B (S7). The confirmation code B includes data obtained by encrypting a code including time information (Y) encrypted with the temporary code T, a random number H, a random number generation time, and a code valid time with the authentication key X. The confirmation code B is displayed on the display device 40, and the administrator notifies the displayed confirmation code B to the user (S8). At this time, it is possible to prevent the user from impersonating by newly connecting (for example, making a call) to the contact information registered in advance to the user and contacting the user.

  The user who is informed of the confirmation code B presses the password authentication button (keyboard 24) of the authentication terminal 10. As a result, the confirmation code inspection program of the authentication terminal 10 is activated and prompts the user to input the confirmation code B and the temporary code T. In response to this, the user inputs the confirmation code B to the authentication terminal 10 (S9), and re-enters the temporary code T input previously (S10). When the authentication terminal 10 and the biometric authentication management server 14 are communicating, the operation of inputting the confirmation code B to the authentication terminal 10 can be omitted.

  The authentication terminal 10 checks the suitability of the code with the time information, the terminal ID, and the site ID included in the code input as the confirmation code B (S11). In the case of nonconformity, the authentication terminal 10 notifies the user of non-permission.

  If it matches (S11), the authentication terminal 10 generates a one-time password including the terminal ID and site ID of the authentication terminal 10 and the random number H included in the confirmation code B (S12), and sends it to the biometric authentication management server 14. A request for issuing a one-time password is made (S13).

  In response to the one-time password request from the authentication terminal 10, the biometric authentication management server 14 similarly receives the one-time password including the terminal ID and site ID of the authentication terminal 10 and the random number H used in generating the confirmation code B. Generate (S14). Naturally, the one-time password generated by the authentication terminal 10 in step S12 matches the one-time password generated by the biometric authentication management server 14 in step S14. The biometric authentication management server 14 notifies the generated one-time password to the authentication using device 16 and requests the current user of the authentication terminal 10 to change the password (S15). In response to this, the authentication using device 16 changes the password for the current user of the authentication terminal 10 to the one-time password from the biometric authentication management server 14.

  The authentication terminal 10 transmits the one-time password generated in step S12 to the authentication utilization device 16 as an authentication password (S16). After confirmation of the authentication using device 16, the current user of the authentication terminal 10 can use the service or function of the authentication using device 16.

  FIG. 3 shows a detailed flowchart of the terminal identification code generation process (step S3) of FIG. When the user selects password authentication with the authentication mode switching button, the terminal identification code generation program of the flow shown in FIG. 3 is started. The CPU 34 of the authentication terminal 10 displays the input screen of the temporary code T on the display device 22 and prompts the user to input the temporary code (S21). The user inputs the temporary code T arbitrarily considered on the spot using the keyboard 24 (S22).

  The CPU 34 fetches the current time, that is, the input time of the temporary code T from the timer 28 (S23), and encrypts the fetched time using the temporary code T as an encryption key (S24). The encrypted time information is assumed to be an encrypted time code Y.

  The CPU 34 reads out the terminal ID, the site ID, and the authentication key X from the storage device 32, and encrypts a code obtained by connecting the terminal ID and the site ID with the authentication key X (S25). The terminal identification code A is generated by concatenating the number of characters of the code Y, the code Y, and the code generated in step S25 (S26). That is, A = “number of characters of Y” + Y + encrypted with the authentication key X (terminal ID + site ID). When the code Y has a fixed length, the information on the number of characters of Y is not necessary, but the unspecified length is more secure for security. The CPU 34 displays the generated terminal identification code A on the display device 22 (S27).

  The user reads the displayed terminal identification code A and notifies the administrator as described above.

  FIG. 4 shows a detailed flowchart of the confirmation code generation process (steps S5 to S8) in the biometric authentication management server 14.

  The administrator activates the confirmation code generation program on the biometric authentication management server 14 and inputs the terminal identification code A (S31). The CPU 50 of the biometric authentication management server 14 uses the number of characters of the code Y arranged at the head of the input terminal identification code A to obtain the code Y from the terminal identification code A and the encrypted terminal ID and site ID. Separate (S32).

  The encrypted terminal ID and site ID are decrypted with the authentication key X of the storage device 48 (S33). The terminal ID and site ID transmitted with the terminal identification code A are collated with the authentication terminal information stored in the storage device 48 to confirm whether it is correct (S34). If it is NG, that is, improper (S34), a disapproval is displayed on the display device 40 (S40). The administrator notifies the user that it is not permitted.

  If the terminal ID and site ID transmitted with the terminal identification code A are appropriate (S34), the CPU 50 fetches the current time from the timer 46 (S35), and generates a random number H by the random number generator 52 (S36). The valid time of the random number H is set (S37). The effective time may be set by the administrator each time, or a default fixed time may be set.

  The CPU 50 encrypts a data string including the number of characters of the random number H, the random number H, the random number generation time, the valid time, and the code Y with the authentication key X (S38). The obtained code is the confirmation code B. The CPU 50 displays the generated confirmation code B on the display device 40 (S39). The administrator notifies the displayed confirmation code B to the user.

  FIG. 5 shows a detailed flowchart of the confirmation code inspection process (S9 to S11) in the authentication terminal 10.

  When the user presses the password authentication button (keyboard 24) of the authentication terminal 10, the confirmation code inspection program is activated. The confirmation code inspection program prompts the user to input the confirmation code B. In response to this, the user inputs a confirmation code to the authentication terminal 10 to the authentication terminal 10 (S51). The CPU 34 of the authentication terminal 10 decrypts the input code (confirmation code B if correct) with the authentication key X (S52). The confirmation code inspection program further prompts the user to re-enter the temporary code T previously input (S10).

  The random number H, random number generation time, valid time, and code Y are separated from the decoding result of step S52 (S54). If the code input in step S51 is equal to the confirmation code B generated by the biometric authentication management server 14 in step S38, the random number H, the random number generation time, the valid time, and the code Y can be correctly separated, and the separation result also includes correct information. Show.

  Using the code re-input in step S53 (or code T if correct), the code Y separated in step S54 is decoded (S55). If the code re-input in step S53 matches the temporary code T input in step S22, the code Y can be decoded and valid time data indicating the input time of the temporary code T can be obtained. In other words, if the code Y is successfully decoded, a user who operates the authentication terminal 10 in the terminal identification code generation process (S3) and a user who operates the authentication terminal 10 in the confirmation code inspection process (S9 to S11) It is the same person.

  The random number generation time and valid time separated in step S54 and the format of the decoding result of the code Y by the decoding in step S55 are checked, and it is checked whether or not all of these indicate time information (S56). If any one of them is not in the time information format (S57), the code input in step S51 or S53 is incorrect, and the confirmation code inspection program displays a disapproval on the display device 22. (S61), the process ends.

  If the time information format check is passed (S57), the CPU 34 fetches the current time from the timer 28 (S58). When the elapsed time from the random number generation time to the current time exceeds the valid time set by the biometric authentication management server 14 (S59), the confirmation code inspection program displays a disapproval on the display device 22 (S61). ),finish. Even when the elapsed time from the input time of the temporary code T (the time taken in in step S23) to the current time exceeds the valid time set in the biometric authentication management server 14 (S60), the confirmation code check The program displays disapproval on the display device 22 (S61) and ends.

  If the current time is within the valid time from the random number generation time and within the valid time from the input time of the temporary code T (S59, S60), the process proceeds to a one-time password issuing process (step S12).

  According to the present embodiment, even when the biometric authentication cannot be used, the use of the authentication using device 16 can be temporarily permitted using the information incorporated for the biometric authentication.

  For user identification, the user's telephone number may be registered in advance, and the user may be identified by an incoming call from the registered telephone number. Further, a specific question may be asked to the user, and the user may be specified by the answer.

  Although the terminal ID and the site ID are used as information for specifying the authentication terminal, it is obvious that a MAC address, an IP address, or a combination thereof may be used. Since IP addresses are known to be spoofed, it is preferable to combine IP addresses and MAC addresses when using IP addresses.

  Although described as an authentication system that complements a biometric authentication system, the present invention can also be used as an authentication method or system that enables temporary use.

  Although the invention has been described with reference to specific illustrative embodiments, various modifications and alterations may be made to the above-described embodiments without departing from the scope of the invention as defined in the claims. This is obvious to an engineer in the field to which the present invention belongs, and such changes and modifications are also included in the technical scope of the present invention.

It is a schematic block diagram of one Example of this invention. It is a flowchart which shows the basic operation | movement of a present Example. The detailed flowchart of the terminal specific code generation process (step S3) in the authentication terminal 10 is shown. The detailed flowchart of the confirmation code production | generation process (step S5-S8) in the biometrics management server 14 is shown. A detailed flowchart of the confirmation code inspection process (S9 to S11) in the authentication terminal 10 is shown.

Explanation of symbols

10: Authentication terminal 12: Communication network 14: Biometric authentication management server 16: Authentication using device 20: Reading / feature extraction device 22: Display device 24: Keyboard (or touch panel)
26: Communication device 28: Timer 30: Authentication mode switching button 32: Storage device 34: CPU
40: Display device 42: Keyboard (or touch panel)
44: Communication device 46: Timer 48: Storage device 50: CPU
52: Random number generator

Claims (8)

An authentication system comprising an authentication terminal and an authentication management server,
The authentication terminal comprises a terminal identification code generating means for receiving a temporary code consisting of an arbitrary character string and generating a terminal identification code including information for identifying the authentication terminal from the temporary code;
The authentication management server includes a confirmation code generation unit that confirms the validity of the authentication terminal according to the terminal identification code, and generates a confirmation code including information indicating the temporary code if the authentication management server is valid.
The authentication terminal
Confirmation code inspection means for accepting input of a code corresponding to the confirmation code and a code corresponding to the temporary code, and inspecting the suitability of the code corresponding to the confirmation code;
A first one-time password generation requesting means for generating a one-time password and requesting the authentication management server to generate the same one-time password when the confirmation code checking means determines that it is suitable;
Password transmitting means for transmitting the one-time password generated in the first one-time password generation request step to the authentication utilization apparatus for authentication;
The authentication management server includes a second one-time password generation request unit that generates the one-time password according to a request from the authentication terminal and requests the authentication using apparatus to change the password. Authentication system.   The terminal identification code includes temporary code input time information encrypted with the temporary code, and information obtained by encrypting terminal identification information for identifying the authentication terminal with a predetermined encryption key. The authentication system according to 1.   The confirmation code includes data obtained by encrypting a code including a random number, a generation time of the random number, a valid time, and a temporary code input time information encrypted with the temporary code with the predetermined encryption key. The authentication system according to claim 2. The confirmation code inspection means
Means for checking whether the time information included in the confirmation code conforms to the time information format;
4. The authentication system according to claim 3, further comprising means for inspecting whether the temporary code input time, the random number generation time, and the inspection time of the confirmation code inspection step are in conformity with the effective time. . In an authentication system consisting of an authentication terminal and an authentication management server,
In the authentication terminal, a terminal specifying code generation step of receiving a temporary code composed of an arbitrary character string and generating a terminal specifying code including information for specifying the authentication terminal from the temporary code;
In the authentication management server, confirming the validity of the authentication terminal according to the terminal identification code, and if valid, a confirmation code generating step for generating a confirmation code including information indicating the temporary code;
In the authentication terminal, a confirmation code inspection step for accepting input of a code corresponding to the confirmation code and a code corresponding to the temporary code, and inspecting the suitability of the code corresponding to the confirmation code;
A first one-time password generation request step for generating a one-time password and requesting the authentication management server to generate the same one-time password when it is determined that the confirmation code inspection step is compatible in the authentication terminal. When,
In the authentication management server, in accordance with a request from the authentication terminal, a second one-time password generation request step for generating the one-time password and requesting the authentication using device to change the password;
An authentication method comprising: a password transmission step in which the authentication terminal transmits the one-time password generated in the first one-time password generation request step to the authentication utilization apparatus for authentication.   The terminal identification code includes temporary code input time information encrypted with the temporary code, and information obtained by encrypting terminal identification information for identifying the authentication terminal with a predetermined encryption key. 5. The authentication method according to 5.   The confirmation code includes data obtained by encrypting a code including a random number, a generation time of the random number, a valid time, and a temporary code input time information encrypted with the temporary code with the predetermined encryption key. The authentication method according to claim 6. The verification code inspection step is
Check whether the time information included in the confirmation code conforms to the time information format,
8. The authentication method according to claim 7, wherein the temporary code input time, the random number generation time, and the inspection time of the confirmation code inspection step are inspected to be compatible with the effective time.

Images